fix(state): cast empty/null boolean parameters to false

ValueCaster::toBool returned empty and "null" string values unchanged,
so they reached the database as raw strings each driver coerced
differently (SQLite matched nothing, MySQL/PostgreSQL coerced to false).
Cast them to false in PHP for deterministic ExactFilter behavior across
drivers; genuinely invalid values are still returned untouched so
constraint validation keeps rejecting them.

Author: soyuka

src/State/Parameter/ValueCaster.php

@@ -30,7 +30,7 @@ public static function toBool(mixed $v): mixed
 
         return match (strtolower($v)) {
             '1', 'true' => true,
-            '0', 'false' => false,
+            '0', 'false', '', 'null' => false,
             default => $v,
         };
     }

src/State/Tests/Parameter/ValueCasterTest.php

@@ -0,0 +1,42 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\Tests\Parameter;
+
+use ApiPlatform\State\Parameter\ValueCaster;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+class ValueCasterTest extends TestCase
+{
+    #[DataProvider('boolProvider')]
+    public function testToBool(mixed $value, mixed $expected): void
+    {
+        $this->assertSame($expected, ValueCaster::toBool($value));
+    }
+
+    public static function boolProvider(): \Generator
+    {
+        yield 'true string' => ['true', true];
+        yield 'numeric 1' => ['1', true];
+        yield 'false string' => ['false', false];
+        yield 'numeric 0' => ['0', false];
+        // Empty and "null" cast to false deterministically across drivers, instead of
+        // reaching the database as a raw string that each driver coerces differently.
+        yield 'empty string' => ['', false];
+        yield 'null string' => ['null', false];
+        // A genuinely invalid value is returned untouched so constraint validation rejects it.
+        yield 'invalid string' => ['string', 'string'];
+        yield 'non-string passthrough' => [true, true];
+    }
+}

tests/Functional/Parameters/BooleanFilterTest.php

@@ -77,9 +77,10 @@ public static function booleanFilterScenariosProvider(): \Generator
     }
 
     /**
-     * With the canonical ExactFilter, a null/empty value is matched literally and yields no
-     * result — unlike the deprecated BooleanFilter which skipped filtering (returning all rows,
-     * covered by the legacy regression suite).
+     * With the canonical ExactFilter, an empty or unparseable boolean value casts to false
+     * (deterministically across drivers), so it matches the inactive rows — unlike the
+     * deprecated BooleanFilter which skipped filtering (returning all rows, covered by the
+     * legacy regression suite).
      */
     #[DataProvider('booleanFilterNullAndEmptyScenariosProvider')]
     public function testBooleanFilterWithNullAndEmptyValues(string $url): void
@@ -90,7 +91,11 @@ public function testBooleanFilterWithNullAndEmptyValues(string $url): void
         $responseData = $response->toArray();
         $filteredItems = $responseData['hydra:member'];
 
-        $this->assertCount(0, $filteredItems, \sprintf('Expected no item for URL %s', $url));
+        $this->assertCount(1, $filteredItems, \sprintf('Expected one inactive item for URL %s', $url));
+
+        foreach ($filteredItems as $item) {
+            $this->assertFalse($item['active'], 'Expected an empty/null boolean value to cast to false');
+        }
     }
 
     public static function booleanFilterNullAndEmptyScenariosProvider(): \Generator